Threat Intelligence

Microsoft Ties China-Linked Group Storm-0940 to ConnectWise Supply Chain Attack

Dark Reading · 23 Oct 2026

Key Takeaway Ask your IT providers and software vendors how they secure their own systems, and make sure you can quickly review and limit the access they have to your environment.

Microsoft has attributed a supply chain attack involving ConnectWise to Storm-0940, a China-linked threat actor. According to the report, the group used an AI-enabled penetration-testing tool to automate and speed up its activity, and the attack affected more than 2,200 tenants.

The scale of the incident shows how a single compromise of a widely used software provider can reach thousands of organisations at once. It also shows how tools built for legitimate security testing can be turned to hostile use, helping attackers work faster and cover more targets with less manual effort.

The available summary does not detail how the attack unfolded or which organisations were affected. Businesses that rely on ConnectWise products, or on managed service providers that do, should watch for guidance from their vendors and from Microsoft.

Summarised by CISO AI from Dark Reading, written with Claude Sonnet 5.5. We link back to every original so you can read it yourself.